SUSE-SU-2024:1652-1 Security update for postgresql16

This update for postgresql16 fixes the following issues: PostgreSQL upgrade to version 16.3 bsc1224051: - CVE-2024-4317: Fixed visibility restriction of pgstatsext and pgstatsextexprs entries to the table owner bsc1224038. Bug fixes: - Fix incompatibility with LLVM 18. - Prepare for PostgreSQL 17...

Race Condition

Overview Microsoft.AspNetCore.App.Runtime.win-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Race Condition through the...

PYSEC-2024-264

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue...

PT-2024-26128 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Hoppscotch Browser Extension versions prior to 0.35 Description: The issue arises from an oversight in the Hoppscotch Browser Extension, allowing messages to be sent and processed from unauthorized origins. This exposes users to potential...

OESA-2024-1525 youker-assistant security update

Integrated tool to aid in routine system maintenance tasks Kylin Assistant is a tool designed to help Ubuntu and Ubuntu Kylin desktop users manage and maintain many aspects of their working environment conveniently in a single application, providing a consistent user experience. Security Fixes: A...

PT-2024-31862 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.7 through 16.9.6 GitLab EE versions 16.10 through 16.10.4 GitLab EE versions 16.11 through 16.11.1 Description: An issue has been discovered in GitLab EE, where an attacker could force a user with an active SAML session ...

PT-2024-22629 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions prior to 17.0.0 Description: When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic...

PT-2024-30694

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50 Description The issue is related to the function folio wait writeback which requires that no spinlocks are held and that a folio reference is held. After dropping the PTL, the folio could get freed...

CVE-2024-34072 Deserialization of Untrusted Data in sagemaker-python-sdk

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.basedeserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently ma...

PT-2024-20171 · Merge · Merge Dicom Toolkit C/C++

Name of the Vulnerable Software and Affected Versions: Merge DICOM Toolkit C/C++ versions ≤5.17.0 Description: The issue is related to the use of an externally-controlled format string vulnerability in the Merge DICOM Toolkit C/C++ on Windows. When the MC Open Association function is used to open...

PT-2024-24735 · Apache · Apache Apisix

Name of the Vulnerable Software and Affected Versions: Apache APISIX versions 3.8.0 through 3.9.0 Description: The issue is related to an Inconsistent Interpretation of HTTP Requests, also known as 'HTTP Request Smuggling', in Apache APISIX when using the forward-auth plugin. Recommendations: For...

PT-2024-20717 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.2.0 through 11.2.4 IBM Cognos Analytics versions 12.0.0 through 12.0.2 Description: The issue is related to injection attacks in application logging due to the lack of sanitization of user-provided data. This...

SUSE CVE-2024-3203

A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit...

Medium: httpd

Issue Overview: Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58. CVE-2023-38709 HTTP Response splitting in multiple modules in Apache HTTP Server allows an...

PT-2024-25399 · Accessally · Popupally

Name of the Vulnerable Software and Affected Versions: PopupAlly versions n/a through 2.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS in AccessAlly PopupAlly. Recommendations: For...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection due to a particular API endpoint modification by authenticated backoffice users, which allows the inclusion and execution of arbitrary SQL commands without proper sanitization or validation. An attacker can manipulate...

SUSE-SU-2024:1416-1 Security update for cockpit-wicked

This update for cockpit-wicked fixes the following issues: - CVE-2023-26364: Fixed denial of service due to improper input validation during CSS parsing bsc1217325 Other fixes: - Upgrade to version 4.5...

UBUNTU-CVE-2024-32040

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the NSC codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not...

PT-2024-24024 · Mailmunch · Mailchimp Forms By Mailmunch

Name of the Vulnerable Software and Affected Versions: MailChimp Forms by MailMunch versions 3.2.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview OpenTelemetry.Instrumentation.AspNetCore is an ASP.NET Core instrumentation for OpenTelemetry .NET Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the logging of sensitive query parameters by default. This...